hashicorp / hashicorp/packer-plugin-amazon

amazon-ebs assume role session tags ignored

Open
#331 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

#### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

#### Overview of the Issue

I'm trying to build AWS custom AMI assuming a role that requires session request tags in its policy condition:
https://docs.aws.amazon.com//IAM/latest/UserGuide/id_session-tags.html
I'm unable to configure packer to fulfill below condition:
```
"Condition": {
"StringEquals": {
"aws:RequestTag/team": "MYTEAM"
}
}
```

### Packer version

`1.8.5`

### Operating system and Environment details

Packer docker image `hashicorp/packer:1.8.5`

#### Reproduction Steps

short version:
`docker run -it --rm -e PACKER_LOG=1 hashicorp/packer:1.8.5 build -debug custom-emr-ami.json`

full version (details in logs):

`aws --profile temporary-user sts get-session-token &> get-session-token`

`docker run -it --rm --name packer -v $(pwd):/workspace -w /workspace -e PACKER_LOG=1 -e AWS_ACCESS_KEY_ID=$(cat get-session-token | jq -r .Credentials.AccessKeyId) -e AWS_SECRET_ACCESS_KEY=$(cat get-session-token | jq -r .Credentials.SecretAccessKey) -e AWS_SESSION_TOKEN=$(cat get-session-token | jq -r .Credentials.SessionToken) -e AWS_REGION=eu-central-1 hashicorp/packer:1.8.5 build -var AmazonOsReleaseLabel=2.0.20221210.1 -var prefix=my-dev -var packerPath=/tmp/downloads -debug custom-emr-ami.json`

### Packer Templates

working template with policy without conditions -> [HERE](https://gist.github.com/moss2k13/212008f24f366300b59b8a2bfc7dd6f2)
not working template with policy with conditions -> [HERE](https://gist.github.com/moss2k13/d5b2afbf7f411296d7c15aa4005ca597)

### Logs

Packer working output with policy without conditions -> [HERE](https://gist.github.com/moss2k13/3f1ec9649c1a957c1521e89e01d96a4e)
Packer not working output with policy with conditions -> [HERE](https://gist.github.com/moss2k13/01e9109fc5ef665bb0b0de6181eac08a)
AWS trust policy for packer-test-role -> [HERE](https://gist.github.com/moss2k13/163cd90d4dd25f257f1e1ba95eb93a87)
AWS packer-test-role policy without condition -> [HERE](https://developer.hashicorp.com/packer/plugins/builders/amazon#iam-task-or-instance-role)
AWS packer-test-role policy with condition -> [HERE](https://gist.github.com/moss2k13/6ae5c598a8a901fc90605f1a1d1219fa)
AWS logs working DescribeImages with policy without conditions -> [HERE](https://gist.github.com/moss2k13/7c27b311fc028f8ea6082d58fe42354e)
AWS logs not working DescribeImages with policy with conditions -> [HERE](https://gist.github.com/moss2k13/e1ac50784c80b01426cfaa9d8d57a2b4#file-aws-logs-describeimage-packerwithconditions-json-L30)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.